| 151 | } |
| 152 | |
| 153 | func (this *RuleSet) PerformActions(waf *WAF, group *RuleGroup, req requests.Request, writer http.ResponseWriter) PerformResult { |
| 154 | if len(waf.Mode) != 0 && waf.Mode != firewallconfigs.FirewallModeDefend { |
| 155 | return PerformResult{ |
| 156 | ContinueRequest: true, |
| 157 | } |
| 158 | } |
| 159 | |
| 160 | var isAllowed = this.hasAllowActions |
| 161 | var allowScope = this.allowScope |
| 162 | var continueRequest bool |
| 163 | var goNextGroup bool |
| 164 | var goNextSet bool |
| 165 | |
| 166 | // 先执行allow |
| 167 | for _, instance := range this.actionInstances { |
| 168 | if !instance.WillChange() { |
| 169 | continueRequest = req.WAFOnAction(instance) |
| 170 | if !continueRequest { |
| 171 | return PerformResult{ |
| 172 | IsAllowed: isAllowed, |
| 173 | AllowScope: allowScope, |
| 174 | } |
| 175 | } |
| 176 | var performResult = instance.Perform(waf, group, this, req, writer) |
| 177 | continueRequest = performResult.ContinueRequest |
| 178 | goNextSet = performResult.GoNextSet |
| 179 | if performResult.IsAllowed { |
| 180 | isAllowed = true |
| 181 | allowScope = performResult.AllowScope |
| 182 | goNextGroup = performResult.GoNextGroup |
| 183 | } |
| 184 | } |
| 185 | } |
| 186 | |
| 187 | // 再执行block|verify |
| 188 | for _, instance := range this.actionInstances { |
| 189 | // 只执行第一个可能改变请求的动作，其余的都会被忽略 |
| 190 | if instance.WillChange() { |
| 191 | continueRequest = req.WAFOnAction(instance) |
| 192 | if !continueRequest { |
| 193 | return PerformResult{ |
| 194 | IsAllowed: isAllowed, |
| 195 | AllowScope: allowScope, |
| 196 | } |
| 197 | } |
| 198 | var performResult = instance.Perform(waf, group, this, req, writer) |
| 199 | continueRequest = performResult.ContinueRequest |
| 200 | goNextSet = performResult.GoNextSet |
| 201 | if performResult.IsAllowed { |
| 202 | isAllowed = true |
| 203 | allowScope = performResult.AllowScope |
| 204 | goNextGroup = performResult.GoNextGroup |
| 205 | } |
| 206 | return PerformResult{ |
| 207 | ContinueRequest: performResult.ContinueRequest, |
| 208 | GoNextGroup: goNextGroup, |
| 209 | GoNextSet: performResult.GoNextSet, |
| 210 | IsAllowed: isAllowed, |